lune-org/docs
1
0
Fork 0
mirror of https://github.com/lune-org/docs.git synced 2025-04-04 18:40:59 +01:00
Code Issues Projects Releases Packages Wiki Activity

refactor(module): require AoT and provide those instead of checking lune require

Browse source
This commit is contained in:
Erica Marigold 2024-05-15 19:53:05 +05:30
parent 772cd3b1ba
commit e3a5c1a3f3
No known key found for this signature in database
GPG key ID: 2768CC0C23D245D1
3 changed files with 136 additions and 123 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

117
modules/sandbox.luau
View file

@ -1,11 +1,14 @@
local fs = require("@lune/fs") local fs = require("@lune/fs")
local luau = require("@lune/luau") local luau = require("@lune/luau")
local process = require("@lune/process") local process = require("@lune/process")
local serde = require("@lune/serde")
local stdio = require("@lune/stdio") local stdio = require("@lune/stdio")
local processArgs = table.clone(process.args) local task = require("@lune/task")
local filePath: string = table.remove(processArgs, 1) or error("usage: lune run sandbox [SCRIPT_PATH] -- [ARGS]")
local processArgs = table.clone(process.args)
local filePath: string = table.remove(processArgs, 1)
or error("usage: lune run sandbox [SCRIPT_PATH] -- [ARGS]")
local DEFAULT_REQUIRE = require
local DEFAULT_PRINT = print local DEFAULT_PRINT = print
local SANDBOXED_ENV = { local SANDBOXED_ENV = {
debugName = filePath, debugName = filePath,
@ -18,6 +21,28 @@ local SANDBOXED_ENV = {
}, },
} }
local PROMPT_MSG_TMPL = `allow {SANDBOXED_ENV.debugName} to access %s?`
local DENIED_ERR_TMPL = `{SANDBOXED_ENV.debugName} tried to access disallowed library %s!`
local function constructSandboxMt(requirePath: string)
return function(self, key)
local module = require(requirePath)
return module[key]
end
end
local function constructProtectedLibMt(libName: string)
return function(self, key)
local allow: boolean = stdio.prompt("confirm", string.format(PROMPT_MSG_TMPL, libName))
if allow then
return constructSandboxMt(`@lune/{libName}`)(self, key)
end
error(string.format(DENIED_ERR_TMPL, "fs"))
end
end
local function discoverAndReadScript(filePath: string): string local function discoverAndReadScript(filePath: string): string
local scriptContents: string local scriptContents: string
@ -66,67 +91,51 @@ local function sandboxPrint(...: any)
DEFAULT_PRINT(`---------------------------------------`) DEFAULT_PRINT(`---------------------------------------`)
end end
local function sandboxedRequire(path: string) local SANDBOXED_LUNE_STD_LIB = {
if path:find("@lune") then ["@lune/fs"] = setmetatable({}, {
local module = path:split("/")[2]:gsub("%s", "") __index = constructProtectedLibMt("fs"),
}),
if module == "net" or module == "fs" or module == "process" or module == "roblox" then ["@lune/luau"] = luau,
local allow: boolean = ["@lune/process"] = setmetatable({}, {
stdio.prompt("confirm", `allow {SANDBOXED_ENV.debugName} to access {module}?`) __index = constructProtectedLibMt("process"),
}),
if allow then ["@lune/stdio"] = setmetatable({
local moduleRequire = DEFAULT_REQUIRE(path) write = sandboxPrint,
ewrite = sandboxPrint, -- TODO: do this
return setmetatable({}, { }, {
__index = function(_, key) __index = constructSandboxMt("@lune/stdio"),
local value = moduleRequire[key] }),
["@lune/net"] = setmetatable({}, {
if typeof(value) == "function" then __index = constructProtectedLibMt("net"),
if module == "roblox" and key == "getAuthCookie" then }),
["@lune/roblox"] = setmetatable({
getAuthCookie = function(...)
local allowAuthCookie: boolean = stdio.prompt( local allowAuthCookie: boolean = stdio.prompt(
"confirm", "confirm",
`allow {SANDBOXED_ENV.debugName} to access your .ROBLOSECURITY token?` `allow {SANDBOXED_ENV.debugName} to access your .ROBLOSECURITY token?`
) )
if allowAuthCookie then if allowAuthCookie then
return value local getAuthCookie = constructSandboxMt("@lune/roblox")({}, "getAuthCookie")
end return getAuthCookie(...)
end end
return function(...) error(
warn(`{SANDBOXED_ENV.debugName} invoked {key} with args {...}`) `{SANDBOXED_ENV.debugName} attempted to access .ROBLOSECURITY token even when denied`
return value(...) )
end
end
if module == "process" and key == "args" then
return processArgs
end
return value
end, end,
__tostring = function()
return stdio.format(moduleRequire)
end,
})
end
error(`{SANDBOXED_ENV.debugName} tried to access disallowed library {module}`)
end
local otherModule = DEFAULT_REQUIRE(path)
if module == "stdio" then
return setmetatable({
write = sandboxPrint,
ewrite = sandboxPrint,
}, { }, {
__index = otherModule, __index = constructSandboxMt("@lune/roblox"),
}) }),
end ["@lune/serde"] = serde,
["@lune/task"] = task,
}
return otherModule local function sandboxedRequire(path: string)
local module = SANDBOXED_LUNE_STD_LIB[path]
if module then
return module
else else
local contents = discoverAndReadScript(path) local contents = discoverAndReadScript(path)
@ -135,8 +144,6 @@ local function sandboxedRequire(path: string)
end end
end end
SANDBOXED_ENV.environment.require = sandboxedRequire SANDBOXED_ENV.environment.require = sandboxedRequire
SANDBOXED_ENV.environment.getfenv = sandboxGetfenv SANDBOXED_ENV.environment.getfenv = sandboxGetfenv
SANDBOXED_ENV.environment.setfenv = sandboxSetfenv SANDBOXED_ENV.environment.setfenv = sandboxSetfenv

1
modules/test.luau
View file

@ -1 +0,0 @@
print(require("@lune/roblox ").getAuthCookie())

117
pages/getting-started/5-security.mdx
View file

@ -26,11 +26,14 @@ Copy the source below and place it in a file named `sandbox.luau`:
local fs = require("@lune/fs") local fs = require("@lune/fs")
local luau = require("@lune/luau") local luau = require("@lune/luau")
local process = require("@lune/process") local process = require("@lune/process")
local serde = require("@lune/serde")
local stdio = require("@lune/stdio") local stdio = require("@lune/stdio")
local processArgs = table.clone(process.args) local task = require("@lune/task")
local filePath: string = table.remove(processArgs, 1) or error("usage: lune run sandbox [SCRIPT_PATH] -- [ARGS]")
local processArgs = table.clone(process.args)
local filePath: string = table.remove(processArgs, 1)
or error("usage: lune run sandbox [SCRIPT_PATH] -- [ARGS]")
local DEFAULT_REQUIRE = require
local DEFAULT_PRINT = print local DEFAULT_PRINT = print
local SANDBOXED_ENV = { local SANDBOXED_ENV = {
debugName = filePath, debugName = filePath,
@ -43,6 +46,28 @@ local SANDBOXED_ENV = {
}, },
} }
local PROMPT_MSG_TMPL = `allow {SANDBOXED_ENV.debugName} to access %s?`
local DENIED_ERR_TMPL = `{SANDBOXED_ENV.debugName} tried to access disallowed library %s!`
local function constructSandboxMt(requirePath: string)
return function(self, key)
local module = require(requirePath)
return module[key]
end
end
local function constructProtectedLibMt(libName: string)
return function(self, key)
local allow: boolean = stdio.prompt("confirm", string.format(PROMPT_MSG_TMPL, libName))
if allow then
return constructSandboxMt(`@lune/{libName}`)(self, key)
end
error(string.format(DENIED_ERR_TMPL, "fs"))
end
end
local function discoverAndReadScript(filePath: string): string local function discoverAndReadScript(filePath: string): string
local scriptContents: string local scriptContents: string
@ -91,67 +116,51 @@ local function sandboxPrint(...: any)
DEFAULT_PRINT(`---------------------------------------`) DEFAULT_PRINT(`---------------------------------------`)
end end
local function sandboxedRequire(path: string) local SANDBOXED_LUNE_STD_LIB = {
if path:find("@lune") then ["@lune/fs"] = setmetatable({}, {
local module = path:split("/")[2]:gsub("%s", "") __index = constructProtectedLibMt("fs"),
}),
if module == "net" or module == "fs" or module == "process" or module == "roblox" then ["@lune/luau"] = luau,
local allow: boolean = ["@lune/process"] = setmetatable({}, {
stdio.prompt("confirm", `allow {SANDBOXED_ENV.debugName} to access {module}?`) __index = constructProtectedLibMt("process"),
}),
if allow then ["@lune/stdio"] = setmetatable({
local moduleRequire = DEFAULT_REQUIRE(path) write = sandboxPrint,
ewrite = sandboxPrint, -- TODO: do this
return setmetatable({}, { }, {
__index = function(_, key) __index = constructSandboxMt("@lune/stdio"),
local value = moduleRequire[key] }),
["@lune/net"] = setmetatable({}, {
if typeof(value) == "function" then __index = constructProtectedLibMt("net"),
if module == "roblox" and key == "getAuthCookie" then }),
["@lune/roblox"] = setmetatable({
getAuthCookie = function(...)
local allowAuthCookie: boolean = stdio.prompt( local allowAuthCookie: boolean = stdio.prompt(
"confirm", "confirm",
`allow {SANDBOXED_ENV.debugName} to access your .ROBLOSECURITY token?` `allow {SANDBOXED_ENV.debugName} to access your .ROBLOSECURITY token?`
) )
if allowAuthCookie then if allowAuthCookie then
return value local getAuthCookie = constructSandboxMt("@lune/roblox")({}, "getAuthCookie")
end return getAuthCookie(...)
end end
return function(...) error(
warn(`{SANDBOXED_ENV.debugName} invoked {key} with args {...}`) `{SANDBOXED_ENV.debugName} attempted to access .ROBLOSECURITY token even when denied`
return value(...) )
end
end
if module == "process" and key == "args" then
return processArgs
end
return value
end, end,
__tostring = function()
return stdio.format(moduleRequire)
end,
})
end
error(`{SANDBOXED_ENV.debugName} tried to access disallowed library {module}`)
end
local otherModule = DEFAULT_REQUIRE(path)
if module == "stdio" then
return setmetatable({
write = sandboxPrint,
ewrite = sandboxPrint,
}, { }, {
__index = otherModule, __index = constructSandboxMt("@lune/roblox"),
}) }),
end ["@lune/serde"] = serde,
["@lune/task"] = task,
}
return otherModule local function sandboxedRequire(path: string)
local module = SANDBOXED_LUNE_STD_LIB[path]
if module then
return module
else else
local contents = discoverAndReadScript(path) local contents = discoverAndReadScript(path)
@ -160,8 +169,6 @@ local function sandboxedRequire(path: string)
end end
end end
SANDBOXED_ENV.environment.require = sandboxedRequire SANDBOXED_ENV.environment.require = sandboxedRequire
SANDBOXED_ENV.environment.getfenv = sandboxGetfenv SANDBOXED_ENV.environment.getfenv = sandboxGetfenv
SANDBOXED_ENV.environment.setfenv = sandboxSetfenv SANDBOXED_ENV.environment.setfenv = sandboxSetfenv